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1 • A method of detennining a hyperelliptic curve suitable for cryptographic 

purposes, comprising the steps of: 

selecting a CM field K, 

deteiniining a representant system of all isomorphism classes of simple 
principally polarized Abelian varieties having complex multiplication by the maximum order 
inK, 

detennining period matrices associated with the representant system, 
determining theta-nulls, 

determining class polynomials for the CM field over a finite field F q , 

detennining a hyperelliptic curve over the finite field F q and 

specifying the group order n of the divisor class group of the hyperelliptic 

curve. 

2. A method as claimed in claim 1 , wherein the hyperelliptic curve is of genus 2. 

3 . A method as claimed in claim 1 , wherein Igusa invariants are determined from 
the theta-nulls. 

4. A method as claimed in claim 3, wherein the Igusa invariants are used to 
determine the class polynomials. 

5 - A method as claimed in claim 1, wherein Mestre invariants are determined 
from the theta-nulls. 

6 - A method as claimed in claim 5, wherein the Mestre method is used to 
generate the hyperelliptic curve over F„. 
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7. A method as claimed in any of the foregoing claims, wherein a plurality of 
suitable CM fields K and the associated class polynomials are stored in accessible form and a 
CM field is selected from the plurality held in store to determine the hyperelliptic curve. 

8. A method as claimed in any of the foregoing claims, wherein the period 
matrices are used in a Siegel-reduced form. 

9. A method as claimed in any of the foregoing claims, wherein only six theta- 
nulls are determined. 

10. A method as claimed in any of the foregoing claims, wherein, to determine the 
representant system, a test is not made to see whether the fundamental unit of the real 
subfield of the Cm field K is the norm of a unit of the CM field. 

11. A method as claimed in any of the foregoing claims, wherein, to determine the 
representant system, a set of ideal classes is determined. 

12. A method as claimed in claim 1 1, wherein pairs of mutually inverse ideal 
classes are identified and Igusa invariants are detennined from the theta-nulls only once for 
each pair. 

13. A method as claimed in any of the foregoing claims, wherein q is a prime 
number p. 

14. A method as claimed in claim 13, wherein the prime number p is selected such 
that each class polynomial has no more than h k linear factors, where h k is the class number of 
the CM field K. 

15. A method as claimed in any of the foregoing claims, wherein the CM field is 
selected such that the group order n of the divisor class group of the hyperelliptic curve is 
exactly prime. 

16. A method as claimed in any of the foregoing claims, wherein q is the power of 
a prime number p. 
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17. A cryptographic method, wherein keys for encrypting data are determined 
from the group of F q -rational numbers of a hyperelliptic curve that was generated by a 
method as claimed in any one of the foregoing claims. 

18. Cryptographic apparatus using a method according to one of the preceding 
claims. 



19. Sender for sending a message, comprising a cryptographic apparatus for 
encrypting of messages according to claim 18. 

20. Receiver for receiving a message, comprising a cryptographic apparatus for 
decrypting of messages according to claim 18. 



